Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04dmoyLXZ4eDMtNjY3d80hfA

Arbitrary expression injection in Pillow

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.

Permalink: https://github.com/advisories/GHSA-8vj2-vxx3-667w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dmoyLXZ4eDMtNjY3d80hfA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: 3 days ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-8vj2-vxx3-667w, CVE-2022-22817
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-22817
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
• https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
• https://www.debian.org/security/2022/dsa-5053
• https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d91afc11
• https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
• https://security.gentoo.org/glsa/202211-10
• https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
• https://github.com/advisories/GHSA-8vj2-vxx3-667w

Repository: https://github.com/python-pillow/Pillow
Blast Radius: 48.5

Affected Packages